CVE-2024-5326-Poc

CVE-2024-5326 CVE-2024-5326 Post Grid Gutenberg Blocks and WordPress Blog Plugin – PostX = 4.1.2 - Missing Authorization to Arbitrary Options Update Description The Post Grid Gutenberg Blocks and WordPress Blog Plugin – PostX plugin for WordPress is vulnerable to unauthorized modification of data...

Gitlab-RCE

Analysis of RCE vulnerability on Gitlab CVE-2021–22192 I Building This bug occurs on GitLab Community Edition CE and Enterprise Edition EE in versions =13.2, =13.8, =13.9, 13.9.4 You can follow the instructions of lyy289065406 to set up the environment. II Analysis When I started to analyze this...

cve-2013-3900-remediation-report

Remediation Report: CVE-2013-3900 – WinVerifyTrust Vulnerability on Windows Server 2019 Azure VM Overview During a recent authenticated vulnerability assessment conducted using Tenable Nessus, CVE-2013-3900 was detected on a Windows Server 2019 virtual machine hosted in Microsoft Azure. This scan...

CVE-2024-43018

CVE-2024-43018 Assign an ID Be officially populated in CVE - Mitre Index Description Technologies used Source and Sink How to execute it Fix Authors Description While investigating for the thesis https://hdl.handle.net/10316/118126 and https://hdl.handle.net/10316/118059 a new vulnerability on...

ctxdebug

MCP servers for WinDbg, IDA Pro, and x64dbg One stdio interface · 160+ tools · Three debuggers, one client. Quick Start · Architecture · Servers · Workflows · Report an Issue Website · ctxdebug.xyz · Contact · [email protected] · Status · Public alpha For authorized reverse engineering, cras...

aotopsy

AOTopsy A Dart AOT snapshot analyzer. Turns libapp.so — the compiled Dart code inside a Flutter release APK — into function names, class layouts, call graphs, behavioral signals, and readable pseudocode. No Dart VM, no SDK compilation, no runtime fallback. Fork notice: AOTopsy is a fork of...

CVE-2025-62821

Microsoft HEIF Image Extensions msheifstore.dll: Source-buffer under-allocation in CopyPixels path leads to out-of-bounds read and Access Violation DoS When decoding a crafted HEIF image through WIC, the msheif codec allocates a 1-byte source buffer but later attempts to copy a very large amount ...

file-away-exploit

File-Away Exploit CVE-2025-2539 & CVE-2025-2512 📌 Purpose This repository contains vulnerabilities details and scripts found on File-Away, which is a WordPress plugin used to file management. This plugin contains two vulnerabilities that can lead to remote code execution Tested on File-Away...

CVE-2021-39273-CVE-2021-39274

CVE-2021-39273 In XeroSecurity Sn1per 9.0 free version, insecure permissions 0777 are set upon application execution, allowing an unprivileged user to modify the application, modules, and configuration files. This leads to arbitrary code execution with root privileges. CVE-2021-39274 In...

Hacking-pdf.js-vulnerability

🚨 CVE-2024-4367: Arbitrary JavaScript Execution in PDF.js This project demonstrates and analyzes CVE-2024-4367 , a high-severity vulnerability in Mozilla’s PDF.js library that allows arbitrary JavaScript execution through improper type checking in font handling code. Our research shows how a...

CVE-2026-77932

DB-GPT through 0.8.2 contains an unauthenticated remote code execution vulnerability because the /api/v1/chat/react-agent endpoint relies on a mock getuserfromheaders function that grants every caller the admin role. Unauthenticated attackers can send prompts that make the ReAct agent's unsandbox...

CVE-2025-2563

CVE-2025-2563 User Registration & Membership = 4.1.1 - Unauthenticated Privilege Escalation Disclaimer! The information presented in this CVE Common Vulnerabilities and Exposures writeup is for educational and informational purposes only. The details provided are based on publicly available...

detect-CVE-2019-15107-by-pyshark

detect-CVE-2019-15107-by-pyshark I. Overview of CVE-2019-15107 Webmin is a web-based interface for system administration for Unix. Using any web browser, you can set up user accounts, Apache, DNS, file sharing, and more. On August 10, 2019, Turkish cybersecurity researcher Özkan Mustafa Akkuş...

training-application-security

Free Secure Coding & Application Security Training — Open Source SCORM Exercises 40 free, open-source secure coding exercises that teach web application security the way developers learn — by exploiting real vulnerabilities like SQL injection, cross-site scripting XSS, and broken access control,...

CVE-2025-2807

CVE-2025-2807: Motors Plugin Exploit By: Nxploited | Khaled Alenazi ⚠️ Vulnerability Summary Plugin: Motors 📅 Expected to be mass-exploited due to its simplicity and critical impact. 🚫 Technical Details Vulnerable Endpoint: /wp-admin/admin-ajax.php Vulnerable Action: mvlsetupwizardinstallplugin...

CVE-2023-47253

CVE-2023-47253 CVE-2023-47253 | Qualitor povoaVoComArray$REQUEST; if inarray$REQUEST'nmalias', array'dtiniciomesatual', 'dtfimmesatual', 'dtiniciomespassado', Proof of Concept POC Just access the URL with your PHP code in "gridValoresPopHidden" parameter. Researches...

CVE-2025-9345

Proof of Concept Path Traversal in File Manager, Code Editor, and Backup by Managefy Vulnerability Type: Path Traversal Arbitrary File Download Affected Function: ajaxdownloadfile Impact: Authenticated users with low privilege Subscriber+ can download arbitrary files from the server, including...

cve-2017-7269

Buffer overflow in the ScStoragePathFromUrl function in the WebDAV service in Internet Information Services IIS 6.0 in Microsoft Windows Server 2003 R2 allows remote attackers to execute arbitrary code via a long header beginning with "If: http://" in a PROPFIND request, as exploited in the wild ...

CVE-2024-40506

CVE-2024-40506 Cross Site Scripting vulnerability in openPetra v.2023.02 via the serverMHospitality.asmx function. Description : An unauthenticated user can steal cookies from authenticated user, by exploiting a XSS in openPetra v.2023.02 via the serverMHospitality.asmx function. Vulnerable Produ...

CVE-2022-31901

CVE-2022-31901 Denial Of Services DOS in Notepad++x86 in 8.4.3 and before. Description Vulnerability triggering, via opening two specially crafted text files e.g. first.txt & second.txt as input to notepad++. As an illustrative example below, as of 11/07/2022, latest version of Notepad++x86 is...